Analysis
-
max time kernel
149s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 01:41
Static task
static1
Behavioral task
behavioral1
Sample
b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe
Resource
win10v2004-20240709-en
General
-
Target
b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe
-
Size
3.8MB
-
MD5
6ee7644aad712e9299421bda9d6ca7ad
-
SHA1
dec188b06083094dcdb33ea292b1e9695e367734
-
SHA256
b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b
-
SHA512
61977d03965278ddcd7016d4ba7eda1011dca090ecb22297809c082428f98430ba04d513e341a6ab76671f315974955244705b75609cb68dd5489bbeba79cfe2
-
SSDEEP
98304:ki4hTLOMtHDMlANqnfVGPyhcMYg4lSiSLCQrdGLcjFjj/eWKS5h7EleIljztU/qu:ki4hTLOMtHDMlANqnfVGPyhcMYg4lSiQ
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe -
Executes dropped EXE 2 IoCs
pid Process 2892 mcsft.exe 2004 mcsft.exe -
Loads dropped DLL 6 IoCs
pid Process 2024 b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe 2024 b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe 2024 b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe 2024 b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe 2024 b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe 2892 mcsft.exe -
resource yara_rule behavioral1/memory/2004-51-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2004-50-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2004-48-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2004-52-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2004-54-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2004-53-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2004-55-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2004-58-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2004-57-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2004-56-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2004-59-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2004-60-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2004-61-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2004-62-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2004-63-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2004-64-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2004-65-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2004-66-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2004-67-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2004-68-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2004-69-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2004-70-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2004-71-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2004-72-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2004-73-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2892 set thread context of 2004 2892 mcsft.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mcsft.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mcsft.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2004 mcsft.exe Token: SeSecurityPrivilege 2004 mcsft.exe Token: SeTakeOwnershipPrivilege 2004 mcsft.exe Token: SeLoadDriverPrivilege 2004 mcsft.exe Token: SeSystemProfilePrivilege 2004 mcsft.exe Token: SeSystemtimePrivilege 2004 mcsft.exe Token: SeProfSingleProcessPrivilege 2004 mcsft.exe Token: SeIncBasePriorityPrivilege 2004 mcsft.exe Token: SeCreatePagefilePrivilege 2004 mcsft.exe Token: SeBackupPrivilege 2004 mcsft.exe Token: SeRestorePrivilege 2004 mcsft.exe Token: SeShutdownPrivilege 2004 mcsft.exe Token: SeDebugPrivilege 2004 mcsft.exe Token: SeSystemEnvironmentPrivilege 2004 mcsft.exe Token: SeChangeNotifyPrivilege 2004 mcsft.exe Token: SeRemoteShutdownPrivilege 2004 mcsft.exe Token: SeUndockPrivilege 2004 mcsft.exe Token: SeManageVolumePrivilege 2004 mcsft.exe Token: SeImpersonatePrivilege 2004 mcsft.exe Token: SeCreateGlobalPrivilege 2004 mcsft.exe Token: 33 2004 mcsft.exe Token: 34 2004 mcsft.exe Token: 35 2004 mcsft.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2024 b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe 2892 mcsft.exe 2004 mcsft.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2024 wrote to memory of 1912 2024 b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe 30 PID 2024 wrote to memory of 1912 2024 b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe 30 PID 2024 wrote to memory of 1912 2024 b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe 30 PID 2024 wrote to memory of 1912 2024 b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe 30 PID 1912 wrote to memory of 2904 1912 cmd.exe 32 PID 1912 wrote to memory of 2904 1912 cmd.exe 32 PID 1912 wrote to memory of 2904 1912 cmd.exe 32 PID 1912 wrote to memory of 2904 1912 cmd.exe 32 PID 2024 wrote to memory of 2892 2024 b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe 33 PID 2024 wrote to memory of 2892 2024 b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe 33 PID 2024 wrote to memory of 2892 2024 b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe 33 PID 2024 wrote to memory of 2892 2024 b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe 33 PID 2892 wrote to memory of 2004 2892 mcsft.exe 34 PID 2892 wrote to memory of 2004 2892 mcsft.exe 34 PID 2892 wrote to memory of 2004 2892 mcsft.exe 34 PID 2892 wrote to memory of 2004 2892 mcsft.exe 34 PID 2892 wrote to memory of 2004 2892 mcsft.exe 34 PID 2892 wrote to memory of 2004 2892 mcsft.exe 34 PID 2892 wrote to memory of 2004 2892 mcsft.exe 34 PID 2892 wrote to memory of 2004 2892 mcsft.exe 34 PID 2892 wrote to memory of 2004 2892 mcsft.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe"C:\Users\Admin\AppData\Local\Temp\b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\EpSbN.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f3⤵
- Adds Run key to start application
PID:2904
-
-
-
C:\Users\Admin\AppData\Roaming\mcsft.exe"C:\Users\Admin\AppData\Roaming\mcsft.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Roaming\mcsft.exeC:\Users\Admin\AppData\Roaming\mcsft.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2004
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD5a5feca573884d76f559b996d45e8ad9a
SHA10e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda
-
Filesize
3.8MB
MD53a013036e8780cdfe62bedee0f45f492
SHA1b929242e7c02fee00f5349382ef5eb1afce1478c
SHA25623b76a26183a695188f5a992aa9a83c06265660949a64d5334c7ad8cb1e014fb
SHA5122a3523c035040cac9a727aa3a9bf7ae3ff4709f6e0b42f748ed2b817cb651394ca432a6ab77b19653c5c9f530e2797335430ef26a23f940a1481d067e8c3a274